# This is a configuration for the sigul server.

[server]
# Host name of the publically acessible bridge to clients

{% if inventory_hostname.startswith('sign') %}
bridge-hostname: sign-bridge1
server-cert-nickname: sign-vault1 - Fedora Project
{% else %}
bridge-hostname: secondary-signer
server-cert-nickname: secondary-signer-server
{% endif %}

# Port on which the bridge expects server connections
bridge-port: 44333
# Maximum accepted size of payload stored on disk
max-file-payload-size: 5147483648
# Maximum accepted size of payload stored in server's memory
max-memory-payload-size: 1048576

[database]
# Path to a directory containing a SQLite database
;database-path: /var/lib/sigul

[gnupg]
# Path to a directory containing GPG configuration and keyrings
gnupg-home: /var/lib/sigul/gnupg
# Default primary key type for newly created keys
gnupg-key-type: RSA
# Default primary key length for newly created keys
gnupg-key-length: 4096
# Default subkey type for newly created keys, empty for no subkey
gnupg-subkey-type:
# Default subkey length for newly created keys if gnupg-subkey-type is not empty
; gnupg-subkey-length: 2048
# Default key usage flags for newly created keys
gnupg-key-usage: encrypt, sign
# Length of key passphrases used for newsly created keys
passphrase-length: 128

[daemon]
# The user to run as
unix-user: sigul
# The group to run as
unix-group: sigul

[nss]
# Path to a directory containing a NSS database
nss-dir: /var/lib/sigul
# Password for accessing the NSS database.  If not specified, the server will
# ask on startup
; nss-password is not specified by default
# Minimum and maximum versions of TLS used
nss-min-tls: tls1.2
nss-max-tls: tls1.2

[binding]
# List of binding modules enabled
enabled: pkcs11
pkcs11_tokens: yubikey_sv03,yubikey_sv04
pkcs11_yubikey_sv03_pubkey: /etc/sigul/yubikey_sv03.pem
pkcs11_yubikey_sv04_pubkey: /etc/sigul/yubikey_sv04.pem
{% if inventory_hostname.startswith('sign-vault03') %}
pkcs11_yubikey_sv03_privkey: pkcs11:serial=8f2a341e00d7a665;id=%03;type=private
{% else %}
pkcs11_yubikey_sv04_privkey: pkcs11:serial=b38ee13e56b3b987;id=%03;type=private
{% endif %}
